3 ms·
This was the backdoor we found. We found the backdoor with performance issues. Whats more likely - that this is the only backdoor like this in linux, or that t
by josephg 3y ago
This was the backdoor we found. We found the backdoor with performance issues.
Whats more likely - that this is the only backdoor like this in linux, or that there are more out there and this is the one we happened to find?
I really hope someone is out there testing for all of this stuff in linux:
- Look for system() calls in compiled binaries and check all of them
- Look for uses of IFUNC - specifically when a library uses IFUNC to replace other functions in the resulting executable
- Make a list of all the binaries / libraries which don't landlock. Grep the sourcecode of all those projects and make sure none of them expect to be using landlock.
- saagarjha 3y agoAll of this was obfuscated. None of this will be detectable with current static analysis techniques.
- josephg 3y agoIFUNC and landlock could be debugged pretty easily at runtime, just by adding some instrumentation.
- saagarjha 3y agoYes but that requires you to know that someone will use it beforehand.
- josephg 3y agoNow that we know IFUNC can me misused like this, it would be pretty silly if we allow other, future exploits to use the same trick.
- saagarjha 3y agoifunc was only used because it’s an obscure feature that is little-used and provides a way to convert a backdoor into easy execution. There are many others and it would be silly to try to catch them all.
- int_19h 3y agoWe have governments, which even in the face of budget crises and such tend to allocate enormous sums for "national security". Why not have them actually do something useful with that for once and do a manual line-by-line audit of all security-critical code that is underpinning our infrastructure?
- saagarjha 3y agoThey do this, but probably not as much as they should.